Pull the Files Out of a File CARVE
File carving is recovering a file from its bytes alone, with nothing to say where it starts or ends. This finds the signatures in a blob and, by reading each format to its real end, carves the files out whole.
The blob
Drop a memory dump, disk-image fragment or any file to scan for the files inside it — or
Drop a blob. It is scanned in the tab; nothing is uploaded.
Why the end is the hard part
Any tool can find where a JPEG starts — the bytes FF D8 FF are unmistakable. The skill is knowing where it ends, because the wrong end gives you a truncated image or one with a megabyte of unrelated data stuck on. A JPEG can even contain a second, smaller JPEG as its EXIF thumbnail, and a naïve carver stops at the thumbnail's end marker. CARVE walks each format's own structure — JPEG markers, PNG chunks, the PDF's %%EOF, the zip's central directory — to the byte the file actually ends on.